PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25605 Siemens CVE debrief

CVE-2026-25605 affects Siemens SICAM SIAPP SDK versions before 2.1.7. The issue is a file-deletion validation flaw: the application may remove a file or socket when the target path or object is not properly validated. In practice, that can let an attacker delete items the process is allowed to remove, leading to denial of service or service disruption.

Vendor
Siemens
Product
SICAM SIAPP SDK
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-10
Original CVE updated
2026-03-17
Advisory published
2026-03-10
Advisory updated
2026-03-17

Who should care

Organizations using Siemens SICAM SIAPP SDK, especially product teams, system integrators, and operators responsible for deployments where local access or service availability is critical.

Technical summary

According to the CISA-corroborated Siemens advisory, the affected application performs file deletion without properly validating the file path or target. The advisory maps the issue to CVSS v3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, indicating local attack conditions with high complexity but no required privileges or user interaction. The practical impact is integrity and availability loss through deletion of files or sockets the process can access. Siemens remediation is to update to V2.1.7 or later.

Defensive priority

Medium — prioritize remediation in any environment where the SDK is deployed and service disruption from local misuse would be operationally significant.

Recommended defensive actions

  • Update Siemens SICAM SIAPP SDK to V2.1.7 or later.
  • Inventory products and systems that embed or depend on the affected SDK version.
  • Review local access controls and apply least privilege so the process can remove only what it must.
  • Monitor for unexpected file or socket deletion behavior in affected deployments.
  • Use standard ICS defense-in-depth practices, including segmentation and hardening, to reduce blast radius if a local misuse path exists.

Evidence notes

CISA’s republished advisory ICSA-26-076-04 lists CVE-2026-25605 for Siemens SICAM SIAPP SDK and states that versions before 2.1.7 are affected. The published date is 2026-03-10 and the advisory was republished/modified by CISA on 2026-03-17. The advisory text describes improper validation of the file path or target during file deletion, with potential denial of service or service disruption. The provided remediation is to update to V2.1.7 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25605 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25605

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25605 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25605

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-076-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-903736.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-903736.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-076-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.